Fixed penalties for procedural breaches under BIS / EAR: the essentials

An export-compliance team at a mid-sized manufacturing group receives a letter from the Bureau of Industry and Security. The letter is not a criminal referral. It is not a proposed charging letter alleging a deliberate unlicensed shipment. It concerns a procedural breach: a missed record, a late filing, a reporting obligation that fell through the cracks during a corporate reorganisation. The temptation is to treat it as low-stakes. That instinct is often wrong.

Fixed penalties for procedural breaches under BIS / EAR rules sit within the Bureau of Industry and Security's civil enforcement authority under the Export Administration Regulations. BIS can assess civil penalties on a per-violation basis for failures that carry no criminal intent and no deliberate export violation – record-keeping gaps, reporting failures, and administrative non-compliance each carry their own exposure. As of January 2026, the regulatory environment has tightened: anti-circumvention enforcement is a declared priority, and procedural failures are increasingly treated as indicators of deeper systemic risk rather than isolated clerical errors.

This briefing covers who administers the regime, what obligations are in scope, how penalties are calculated and compared across the major regimes, the risk flags that turn a procedural matter into a larger investigation, and when external counsel becomes necessary.

Who administers fixed penalties for procedural breaches under BIS / EAR?

The Bureau of Industry and Security, operating within the US Department of Commerce, administers the Export Administration Regulations and holds primary civil enforcement authority for procedural breaches within that regime. BIS's Office of Export Enforcement conducts investigations and pursues civil penalty actions; the Office of Chief Counsel manages the legal proceedings. Criminal referrals go to the Department of Justice, but the vast majority of procedural enforcement actions remain within BIS's own civil jurisdiction.

The legal authority derives from the Export Control Reform Act and the underlying statutory framework – not from sanctions legislation. This distinction matters. OFAC administers economic sanctions under IEEPA; BIS administers export controls under the EAR. The two regimes can apply to the same transaction simultaneously, but they operate through separate enforcement chains, separate penalty frameworks, and separate licensing or licensing-exception structures.

For a business subject to both sets of rules – and many cross-border manufacturers are – the question is not simply "did we violate export controls?" It is also "did the same conduct engage OFAC prohibitions, and if so, have we reported to both regulators?" We regularly advise clients who have received a BIS inquiry where an OFAC dimension surfaces only after the initial scoping exercise begins.

What does BIS / EAR require in relation to procedural obligations and record-keeping?

The EAR imposes a set of obligations that operate independently of whether a controlled item is ultimately exported: record-keeping requirements, filing obligations associated with the Automated Export System, maintenance of end-use and end-user documentation, and specific reporting duties linked to licence conditions and licence exceptions. A breach of any of these can attract a civil penalty even if the underlying shipment was entirely lawful.

Items subject to the EAR are classified by reference to an Export Control Classification Number (ECCN – the item's classification on the Commerce Control List, which determines what licence requirements and licence exceptions apply). Items that are subject to the EAR but do not sit on the Commerce Control List are designated EAR99. Even EAR99 items can generate procedural obligations in certain circumstances, for example where an end-use statement has been obtained or where a licence exception is being relied upon that carries documentation conditions.

Record-keeping sits at the centre of procedural compliance. Exporters, freight forwarders, and others involved in export transactions are required to retain records relating to those transactions for a defined period. BIS audits and investigations routinely begin with a records request; the inability to produce records is itself a chargeable violation, separate from any finding about the underlying transaction. How long are you retaining your export documentation, and is the retention policy enforced uniformly across subsidiaries and logistics partners?

Licence conditions impose additional procedural burdens. A licence authorising the export of controlled items to a particular end-user may require post-shipment verification, periodic reporting, or specific marking of goods. Non-compliance with a licence condition is a procedural breach under the EAR even if the item was exported to the correct destination and the correct end-user.

How is a procedural breach identified and investigated?

BIS's Office of Export Enforcement can open an investigation on its own initiative, on referral from another agency – Customs and Border Protection, OFAC, or the Department of Justice – or following a voluntary self-disclosure (VSD – a voluntary submission to BIS identifying a potential violation before the agency has independently detected it). Procedural breaches are commonly identified through customs data, Electronic Export Information filings, and the review of licence conditions in post-shipment audits.

The investigation typically begins with an administrative inquiry: a request for documents, communications, shipping records, and classification memoranda. At this stage, the business has not been formally charged. The response to this initial inquiry – including its completeness, timeliness, and internal consistency – shapes the trajectory of the matter significantly.

In our experience, the most consequential decisions in an export-control enforcement matter are made in the first weeks: what to produce, what legal privilege applies, whether to file a VSD, and whether to engage proactively with the agency. A delayed or piecemeal document response routinely converts a straightforward procedural matter into a more extensive review. The position that staying silent is safer than engaging is one we regularly need to address; it is, in the vast majority of cases, incorrect.

BIS distinguishes between egregious and non-egregious cases, and between matters involving voluntary self-disclosure and those it detects independently. These categories affect both the penalty base and the agency's posture. A procedural breach disclosed proactively, with a thorough internal review and a corrective action plan, is treated differently from the same breach uncovered during an audit.

What does cross-regime comparison reveal about procedural enforcement?

Fixed penalties for procedural breaches under BIS / EAR exist within a broader landscape of parallel enforcement regimes, and a cross-border business cannot treat the BIS framework in isolation. Three comparators are particularly instructive.

OFSI (United Kingdom). OFSI can impose monetary penalties on a strict-liability basis, as currently in force, verify before reliance. The maximum civil penalty is the greater of £1,000,000 or 50 percent of the breach value. OFSI has issued revised enforcement guidance that introduces an early account scheme and a settlement route carrying a discount, alongside fixed penalties of £5,000 and £10,000 for specified procedural breaches – as currently in force, verify before reliance. Where a transaction has a UK nexus, OFSI and BIS exposures can run in parallel, and the procedural steps required by each regulator differ.

OFAC (United States). OFAC's civil-penalty authority under IEEPA operates alongside the BIS enforcement framework. OFAC assesses penalties per violation on a strict-liability basis; there is no requirement to prove knowledge or intent for the civil violation itself. A VSD to BIS in connection with an export-control matter does not discharge any OFAC reporting or blocking-property reporting obligation. Blocked-property and rejected-transaction reports are due to OFAC within 10 business days of the blocking or rejection, as currently in force, verify before reliance. These two clocks run independently.

EU dual-use. The recast EU Dual-Use Regulation governs controls on dual-use items exported from EU member states. The enforcement architecture is national: each member state's own competent authority investigates and penalises violations, and penalty levels vary accordingly. An EU-based subsidiary of a US parent may face simultaneous BIS and EU enforcement for the same underlying item movement if both jurisdictions' rules are engaged. This is not a rare scenario; we see it regularly in the semiconductor and advanced-materials sectors.

The cardinal cross-regime principle is that where two regimes both apply, the stricter prohibition governs. A business that concludes it is compliant under BIS should separately assess whether OFAC or EU restrictions independently prohibit or restrict the same transaction.

What are the principal risk flags that escalate a procedural breach?

Not every procedural breach carries the same risk profile. BIS and external counsel assess escalation risk by reference to a cluster of factors that distinguish an administrative oversight from evidence of systemic non-compliance or, in the worst case, wilful evasion.

The first flag is volume and pattern. A single missing end-use certificate in an otherwise clean record is categorically different from repeated gaps in the same product line or the same destination corridor. BIS analysts look at whether the breach is isolated or reflects a programme failure.

The second flag is destination and end-user profile. Procedural gaps affecting exports of controlled items – particularly items with higher-level ECCNs or items covered by military end-use and end-user restrictions – attract scrutiny that the same procedural gap applied to EAR99 goods would not. BIS administers end-use and end-user controls for specified destinations; a record-keeping failure involving those destinations is examined through that lens.

The third flag is third-party involvement. A sharp change in trade flows to a transit or intermediate jurisdiction is treated by BIS, CBP, and co-operating enforcement agencies as a diversion red flag. A procedural breach that sits alongside an unusual routing pattern will be examined for diversion risk. The analysis follows the item and its intended end-use, not just the formal export record.

The fourth flag is Entity List and Denied Persons List exposure. BIS maintains the Entity List and the Denied Persons List; dealings with parties on those lists require a licence or are prohibited outright. A procedural breach that touches a transaction with a listed party – even inadvertently – changes the analytical frame entirely. Have you screened not only the direct buyer but the logistics chain, the freight forwarder, and intermediate consignees?

The fifth flag is deemed-export exposure. A deemed export occurs when controlled technology is released to a foreign person within the United States, including through remote access to controlled software or technology. This is a frequently overlooked dimension of procedural compliance, particularly in research-intensive and technology-licensing contexts where physical export documentation is absent but controlled transfers are occurring.

What does the EAR require by way of voluntary self-disclosure, and what are the procedural steps?

The EAR recognises voluntary self-disclosure as a mechanism for reporting potential violations to BIS before the agency independently discovers them. A properly filed and well-prepared VSD is a recognised mitigating factor and generally results in a more favourable enforcement outcome, though no outcome is guaranteed and the decision to disclose requires careful analysis of the facts, the disclosure's scope, and any parallel reporting obligations.

The process for a procedural breach typically involves an initial notification to BIS's Office of Export Enforcement confirming that an investigation is under way and a full report will follow, a thorough internal investigation to scope the violations accurately, a written disclosure covering the facts, the regulatory basis for the violation, the root cause, and the corrective actions implemented. The quality and completeness of the submission matters materially; a superficial VSD that understates the scope of violations is worse than no VSD at all, because it combines disclosure with incomplete reporting.

Parallel disclosure obligations require careful co-ordination. Where the same facts implicate OFAC – for example, where a transactional counterparty proves to be a listed person – the OFAC reporting timeline is separate and strictly defined. Both disclosures must be accurate and mutually consistent. In our practice, co-ordinating a multi-regulator disclosure is one of the most technically demanding tasks in an enforcement matter, and it is not work that benefits from delay.

A critical practical point: the decision to file a VSD should be made with legal advice. The disclosure is not privileged once filed, and the scope of what is disclosed shapes the investigation that follows. An over-broad VSD can invite scrutiny of areas that were not initially in scope; an under-broad VSD can result in BIS expanding its review when the full picture emerges.

What common misconceptions arise in relation to BIS / EAR fixed penalties for procedural breaches?

Several persistent misconceptions in this area cause businesses to manage procedural breach risk less effectively than they should.

The most common is the belief that a procedural breach – as distinct from an unlicensed export – is a low-consequence matter. This is incorrect. BIS treats record-keeping and compliance programme failures as evidence of systemic risk, not administrative error. An inadequate compliance programme is an aggravating factor, not a neutral one. The existence of a well-designed and properly implemented compliance programme is, conversely, a mitigating factor.

The second misconception is that the EAR applies only to physical exports. It does not. Deemed exports – controlled technology transfers to foreign persons within the United States – are within the EAR's scope. A compliance programme that monitors only logistics and shipping documentation, and not technology access, cloud-based engineering collaboration, or licensing of controlled software, has a gap that BIS will identify.

The third is that a VSD is always the right answer. It is often the right answer. It is not always. The analysis turns on the nature and scope of the violation, whether BIS has already detected the conduct, whether parallel regimes require separate action, and whether the scope of the potential disclosure is accurately understood. Deciding to disclose before that analysis is complete is itself a risk.

A fourth misconception: that the BIS penalty framework is fixed and predictable in the way that a table of fixed fines might be. In practice, BIS exercises significant discretion. Mitigating factors – prior compliance record, cooperation, the existence of a compliance programme, remediation steps, VSD – interact with aggravating factors – prior violations, deliberate conduct, harm to national security and foreign-policy interests – and the outcome of that interaction is the penalty. Experienced practitioners understand how to present the mitigating case effectively.

Finally, some businesses assume that a procedural breach handled at the compliance team level does not need to reach legal counsel. The EAR is a complex regulatory regime. The intersection with OFAC, the EU dual-use rules, and OFSI – and the need to co-ordinate disclosures across those regimes – requires a level of regime-specific expertise that generalist legal support may not carry.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.